What sensitive business data do we have, and where is it stored?

List the data types the business handles, then map where they are created, stored, shared, backed up, and sent to vendors. Include email, cloud drives, local devices, databases, and third-party services. Classify the most sensitive data so access and retention can be controlled.